Responding to the fallout from the war in Ukraine and planning for adjustments to international business strategy
- Within days of the Russian invasion of Ukraine, the world has seen swift, sometimes unprecedented responses by governments and businesses to discourage escalation of violence and to aid in the growing humanitarian crisis.
- Your senior management and board should take an enterprise risk view to see the interconnections and cascading effects among risk segments: reputational, sanctions, supply chain, third-party, financial, people and cyber.
- Companies activated their crisis playbooks across an array of risks as impacts reverberated unevenly but surely across economies and businesses.
- A month into this war, unfolding events reveal new scenarios your company should consider. Move from crisis playbooks to your enterprise risk management and resilience playbook.
In response to the Russian invasion, many countries are issuing a slew of unprecedented responses — a mix of economic incentives and sanctions — to dissuade escalation of violence and minimize humanitarian impact. The toll on citizens, industrial production and economic growth in several European countries is already evident and may become even heavier.
Businesses are on the front lines of the international effort. By last count, more than 400 companies have curtailed or stopped operations in Russia to comply with sanctions or to express their values. Meanwhile, technology firms are being enlisted on the communication and cyber front lines in allied and partner countries for a war that’s being fought not only on the ground but on social media as well.
This is likely just the beginning. The war in Ukraine is not an isolated incident. Other regional conflicts simmer. The Russian invasion of Ukraine may yet usher in a new international order, a multipolar world of economic competition. Russia has challenged the foundational security arrangement in Europe, ending a long-held belief that economic integration prevents war. Global companies must adopt antifragile strategies to survive these shocks and continue to grow and bring prosperity to their customers and communities.
In a period rife with international uncertainty, we offer guidance on how companies can use their risk management programs to maintain continuity of business operations, reallocate resources and make investments to critical areas. Beyond that, we provide guidance on establishing policies and processes that work in a world that anticipates and braces for strategic, social, political, economic and environmental turbulence.
Take the board lens in overseeing the risks related to the war in Ukraine
In C-suites and boardrooms across the US, senior executives and corporate directors are talking about the war in Ukraine and determining steps their organizations must take in response.
Risk oversight is a key responsibility at the full-board level. Boards and their committees should work with management to understand and calibrate the risk profile and appetite of their organizations, especially in times of crisis, tumultuous change or significant risk events. Oversight of the response carried out by management is also the board’s responsibility. So, too, is actively participating in the company’s response when a significant risk event occurs. Boards should require timely reporting of early warning signals, confirming that management provides alerts as risk events evolve.
Having that enterprise-wide view can make the difference between being nimble and being disrupted. Coordinated actions and responses, based on a foundation of enterprise risk and control, allow businesses to deploy capital and resources more efficiently and effectively.
To illustrate the importance of the enterprise view, consider the ESG lens of investors and other stakeholders. Social considerations draw attention to the impact of a crisis on employees located in the region and the clamor from customers around the world who want the company to disentangle itself from Russian operations. Governance factors demand responses to the impact of sanctions and counterparty relationships. Environmental factors trigger planning for impacts on energy transition and climate-related transition risks. Reputational risks can stem from failure to address any of these factors.
Enterprise-wide questions to consider
- How do shareholders and other stakeholders view geopolitical and related crises in Europe?
- Is there a particular board member assigned to oversee the risks? How actively should the role be played?
- How does your board plan to oversee the various business risks (cyber, supply chain, etc.) exacerbated by the war in Ukraine? Is oversight of the specific risks assigned to different board committees? How is the board looking at the intersections among those risks?
- Is there a designated chief risk officer engaged to focus on how your company responds to given risk events? If not the CRO, who in senior management is responsible?
- Is your organization’s risk management program focused on this crisis, and does the program include the appropriate people, processes and tools to fully understand the nature and magnitude of the relevant risks?
- How might your reputation be affected by your response to the crisis?
- Should your risk appetite change based on the crisis and its impact on your company?
- How can this risk event affect your overall strategy, and are you ready for a pivot in case this risk increases?
Questions to ask about key business risks arising from geopolitical and related crises
Strategic, operational, financial and compliance risks are common level-one risk categories that board members and management need to consider. Reputational risk could be amplified if any or all of these risks are not mitigated properly.
The specifics of sectors and operating models matter because they create variance in risk exposure and impacts. The questions in each risk domain are not intended to be a check-the-box exercise. They’re meant to enable robust cross-functional leadership discussions, specific to your industry and operating model and anchored on your enterprise risk management framework. Formulated as a bridge between the language of business and the jargon of deep specialties, the questions we offer are a starting point for shared understanding and collaborative action.
Financial exposures from the war in Ukraine can be far reaching. We have already seen volatility in global markets and uncertainty will likely continue. Companies with operations in Russia may have trouble funding operations, collecting customer receipts or making vendor payments as sanctioned governments and banks feel the pinch. Nationalization may impact the valuation of investments in Russian assets or subsidiaries, potentially requiring a write-off of the associated value. Investments in assets or subsidiaries in Ukraine may be impacted by damage from the war resulting in a rapid decline in value with uncertainty around the time to recover. Companies with non-US denominated exposure in Russia and Ukraine may see a sharp decline in the Russian ruble and Ukrainian hryvnia currencies. Expect supply and price volatility for commodities (e.g., oil, natural gas, metals, wheat, soy beans) sourced from global markets or directly from Eastern Europe. Companies may be affected by the inability to repatriate cash from subsidiaries or joint ventures in the region as well as deteriorating counterparty risk from affected banks.
Questions to consider around financial risks
1. What exposure do you have to the financial markets impacted by the conflict? Have you considered additional volatility through your scenario planning?
2. Do you have potential “trapped cash” or liquidity shortfalls?
3. What is your exposure to counterparty/liquidity risks arising from sanctions?
4. Have you forecasted the currency exposure impact and considered altering hedging strategies to reduce currency volatility in the short term?
5. Have you evaluated your commodity purchase agreements and existing commodity hedging programs to determine if there is exposure to rising commodity prices?
6. Do you have payment methods that are impacted by sanctions? Could that hinder your ability to meet supply chain or customer/employee obligations?
How can your enterprise risk management program evolve as quickly as risks do?
One month into the war in Ukraine, we know that the risk environment is evolving rapidly. Companies need to exercise vigilance in understanding emerging risks and in acting to reduce exposure and preserve value. Across all risk segments, companies should consider actions to assess, evaluate and plan for the impacts of emerging risks from the crises.
Review your risk appetite framework and KRIs Evaluate your company’s risk appetite through discussions between executive leadership and the board. Evaluate risk scenarios, risk plans and investments in capabilities required to reduce exposure. Recalibrate your company’s risk capacity and align on the acceptable level of risk that you’re willing to take. Follow through by identifying where investment and resource allocation is required. Establish risk tolerances to identify when exposures exceed your risk capacity and appetite. Develop metrics and key risk indicators that trigger alerts to adjust risk plans. Provide frequent updates to affected stakeholders, including the board.
Perform an emerging risk assessment Perform a risk assessment targeting specific risks triggered by the war in Ukraine. Evaluate and assess the changes to your current risk profile. Prioritize the top risks that create the largest exposures to your company. Update leadership and the board on the emerging business risks and the rationale for prioritization of actions. Develop specific risk reporting for these key emerging risks for continuous monitoring by leadership and the board.
Execute a deep dive on your top three emerging risks The emerging risks may have far reaching impacts across your business. In some scenarios, you will have obvious and direct impacts (e.g., rising commodity prices) and other areas may be not so direct (e.g., third parties or suppliers with Russia or Ukraine operations). Performing a deep dive on your risks can help your organization identify and assess the areas of your business that are or may be affected. Evaluate current measures and capabilities to mitigate exposures.
Run crisis scenarios with quantification Companies should evaluate potential best and worst case scenarios, quantifying exposure and impacts where possible. Assess the need to reallocate resources to strengthen capabilities and respond to the risks. Boards, in particular, should ask management about the financial impact of specific risk and risk events under various scenarios.
Build enterprise resiliency The ability to maintain a coordinated response is critical to confirm that critical business services can continue to operate. The most likely disruptive threats facing businesses today require an organization to be able to bridge crisis response, incident management, emergency response, business continuity, and disaster and cyber recovery functions. Coordination of these capabilities doesn’t just happen, not even in sophisticated companies. It takes deliberate effort and investment to develop an integrated resilience program. Where collaborative resilience functions used to be the exception, they now need to be the norm. Integration clears away speed bumps along with unnecessary complexities and costs. Finally, don’t overlook opportunities to invest in the resilience and robustness of your digital infrastructure. The current crisis creates urgency; available technology provides an answer.
The risk landscape is changing from day to day. Your senior executives should get together to connect the dots for a holistic look at the risks your company faces now and down the road, with an eye toward building action plans for dealing with those risks.
Companies learn from crises and navigate strategic risks to evolve and protect their talent, technology, relationships and other assets. Preparing for what President Biden has called a “decisive decade” — fraught with strategic, social, political, economic and environmental challenges — will require nothing less than a reexamination of international business strategies to secure long-term prospects.
Today, in our world of uncertainty, resilience is the value proposition to stakeholders. We’ve already seen this during the pandemic: The market and the customers reward those who can be trusted to deliver on their mission despite formidable challenges.